EswatiniData Protection Act, 2022, rights of data subjects
Data Protection Act, 2022, ss. 19-20, 44, 51 (rights of data subjects)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Confirm free of charge, on request from a data subject who proves their identity, whether you hold personal information about them, and provide it in a reasonable manner, format and prescribed time.NIST Privacy FrameworkCT.DM-P1
- Give a data subject written reasons where you deny an access request, and let them challenge those reasons.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
- Correct, destroy, or delete personal information on a data subject's request within fourteen days where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell anyone the changed information was disclosed to within seven working days of the correction where it affects a decision about the data subject.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Stop processing a data subject's personal information for direct marketing as soon as they give you notice requiring you to cease or not begin such processing.NIST Privacy FrameworkCT.PO-P3
- If you operate a whistleblowing system, preserve fairness, proportionality and openness about its scope and purpose, and inform a person implicated in a report as soon as possible of the report's existence and the facts alleged.NIST Privacy FrameworkCM.AW-P1
- Let a person implicated in a whistleblowing report exercise their rights of access, rectification and deletion, but do not give them access to a third party's personal data without that third party's express written consent.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
What the log must hold
Access record
Logging duty
A controller can answer an access request for the identity of every third party who has or has had access to a data subject's information only if it has kept a record of that access, so section 19(1)(b) carries an implied duty to keep one. The text names no field list, retention period or inspector. Section 20 sets response times (seven working days to inform recipients of a correction, fourteen days to notify the outcome of a request) and states no record, section 44 lets a data subject stop direct marketing, and section 51 has the Commission make whistleblowing rules; none of these requires a log or record. The sections cited here carry no territorial clause, so the hook is empty.
- Kind
- Implicit
- As of
- Provision
- Section 19(1)(b) (a data subject may request the personal information held, including the identity of all third parties who have or have had access to it)
- Trigger
- personal_data_processing
What this law does
Section 19 gives a data subject who proves their identity the right to request free confirmation of whether a controller holds personal information about them and to request that information, including the identity of third parties who have had access to it, and gives a right to written reasons and a right to challenge those reasons where a request is denied.
Section 20 gives a data subject a free right to have inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained personal information corrected or deleted, requires the controller to answer the request within fourteen days, and requires the controller to tell every party the changed information had been disclosed to within seven working days where a correction affects a decision about the data subject.
Section 44 entitles a data subject to require a controller by notice to cease, or not begin, processing their personal data for direct marketing, and lets the Commission order compliance where the controller fails to observe that notice.
Section 51 requires a data controller that operates a whistleblowing system to preserve fairness, proportionality and openness about the scope, purpose and consequences of reporting, and requires a person implicated in a report to be informed as soon as possible of the report's existence and the facts alleged, with a right of access, rectification and deletion that does not extend to a third party's personal data without that person's express written consent.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .